AI in Supply Chain Compliance: What It Can and Cannot Check

Supply chain is where the people I build for ask about AI most hopefully, and the reason is arithmetic. A safety team with 40 contractors reads everything that arrives. A procurement team with 900 suppliers does not, and that gap is where supplier risk lives.

This post is about the part of supplier risk that is not safety: modern slavery reporting, insurance and licence currency, sanctions, and documents at a scale nobody covers by reading. Contractor safety prequalification is a different job, and AI contractor prequalification sets out what an agent reviews there and what a person still decides.

Supplier Risk Is Wider Than Safety.

Start with the part that carries a legal duty.

Section 19 of the model Work Health and Safety Act requires a person conducting a business or undertaking to ensure, so far as is reasonably practicable, the health and safety of workers engaged, or caused to be engaged, by the person. Section 46 requires everyone holding a duty in relation to the same matter to consult, co-operate and co-ordinate activities with all the others, so far as is reasonably practicable.¹

Safe Work Australia is blunt about a labour hire arrangement: the agency and the host are both persons conducting a business or undertaking, both responsible for the worker’s health and safety, and they cannot contract out of or transfer their duties to each other or to another party.²

Nothing in a supply chain transfers an obligation. It only moves the work of checking, and checking is the thing that does not scale.

Around the safety file sit four questions a procurement team owns rather than inherits: whether a supplier is inside the modern slavery reporting regime, whether their insurance and licences are current today, whether they appear on a sanctions list, and whether anyone has read the documents in it.

Modern Slavery Reporting Starts at AU$100 Million.

This is the fact recalled wrongly most often in supplier compliance, so here it is from the Attorney-General’s Department’s own guidance rather than from memory.

An entity must report under the Modern Slavery Act 2018 (Cth) if it has consolidated revenue of at least AU$100 million over its 12-month reporting period, and is either an Australian entity at any time in that period or a foreign entity carrying on business in Australia at any time in that period. The reporting period means the financial year or other annual accounting period the entity already uses. The statement goes to the Attorney-General’s Department through the online register within six months after the end of that period, and it must address seven mandatory criteria, including the risks in the entity’s operations and supply chains and the actions taken to address them.³

The threshold has not moved. Professor John McMillan AO’s statutory review, tabled on 25 May 2023, made 30 recommendations, one of which was to lower the reporting threshold from AU$100 million to AU$50 million. The government responded on 2 December 2024. As at September 2026 the department’s page still states that the requirement applies at annual consolidated revenue of at least AU$100 million.⁴ Statements are published on the Modern Slavery Statements Register, which the government must maintain and which anyone can read.⁵

Two things follow for a supplier program. Suppliers under the threshold owe no statement at all, and asking a small subcontractor for one is how a questionnaire loses its credibility. If you are over the threshold, the answers you collect from suppliers are inputs to your own report.

This is why ComplyFlow’s prequalification form treats modern slavery differently from safety. The section runs ten questions covering prior bribery, corruption or human rights breaches, training, overseas sourcing, labour hire, recruitment fees, written contracts, grievance channels, and cash payment, and the contractor’s responses are not AI-reviewed. They are there to give you visibility into labour practices, risk awareness, and potential areas of concern across your contractor base, and certain answers require a written explanation.⁶ The supplier-facing guidance says the same from the other direction, telling a small business that a statement is only mandatory once annual consolidated revenue exceeds AU$100 million, or they publish one voluntarily.⁷

I would not change that design. A model reading a declaration can tell you the declaration is complete. It cannot tell you it is true. For an ESG or sustainability lead the useful output is not a score. It is ten answers in a comparable shape across every supplier, with the ones that required an explanation already surfaced.

Insurance, Licences, and the Things That Expire.

This is narrow extraction work, and AI is genuinely dependable at it: reading a policy number, a cover level, a name, and an expiry date off a scanned certificate.

In ComplyFlow’s prequalification, each insurance question a supplier answers creates a compliance requirement on their profile: the level of public liability cover, workers compensation by state, personal accident, and professional indemnity. They must maintain what they declared and provide current evidence as policies renew, and where a policy expires or evidence is not provided, their compliance status reflects it.⁶ Behind that sits the requirement set: a bundle of documents, forms, and training you build once, after which ComplyFlow runs the invitations, reminders, and renewals.⁸ That is what keeps a supplier record current rather than accurate on the day it was collected.

Financial checks are where I stop. Credit assessment and financial distress monitoring come up in every procurement conversation, and I cannot point you at documentation for them, so I will not describe them as something we do. The limit is worth saying out loud: a certificate of currency tells you a policy existed on the day it was issued. It does not tell you the supplier can pay its subcontractors next month.

Sanctions Screening, Where a Match Is Only a Flag.

The Australian Sanctions Office, inside the Department of Foreign Affairs and Trade, maintains the Consolidated List: every individual, entity, and vessel subject to Australian sanctions, including targeted financial sanctions, travel bans, arms embargos, and maritime sanctions. Published as a spreadsheet and updated regularly, it was last updated on 8 September 2026. DFAT describes it as a key resource for due diligence checks.⁹

The stakes are not procedural. Dealing with a listed individual or entity is a serious criminal offence, with penalties including up to 10 years in prison for individuals and significant fines for individuals and bodies corporate.⁹

Name matching against that list is work software does better than a person: aliases, transliterations, and near-identical trading names across three entities. A confident false positive costs a supplier a contract; a confident false negative costs you a prosecution. DFAT settles who decides. If you identify a match on the Consolidated List, the instruction is to seek legal advice before proceeding with any dealings involving that person, entity, or vessel.⁹ A screening tool produces a candidate. A person, usually with a lawyer, produces the answer.

Adverse media screening is the weaker sibling. A model reading news is reading allegations, not findings. Summarising what has been published about a supplier is real work; treating a search result as an adverse finding is not, and it is how a supplier loses a contract over somebody else’s unresolved court case.

Document Review at Supplier Scale.

Two mechanisms, both documented.

The first is the review agent. You build it through a guided wizard: choose the document type, define the review criteria, and keep, edit, or weight the criteria the wizard suggests. Before you save it you run the agent against a real sample document and read the actual result, with up to two free previews that consume no tokens.¹⁰

The second is asking your own record a question instead of building a report. ComplyFlow is one of the first compliance platforms with an MCP server, the open standard that lets an assistant such as Claude or GitHub Copilot read another system. Which contractors at a given site have expired insurance documents becomes a question you ask rather than a report somebody builds. Access is read only, so an assistant can look up and summarise but cannot create, change, or delete anything; the token is scoped to the modules you choose, inherits your own permissions and site assignments, and can only reach your organisation’s data.¹¹ The integration side is plumbing. The change is that a question about 900 suppliers no longer needs a report writer and two days.

The Four Things AI Cannot Do Here.

Verify that a document is genuine. It reads what is on the page, and a certificate that was never issued reads exactly like one that was. Where the cover genuinely matters, verification is a call to the insurer or the issuing body.

Turn a declaration into evidence. A supplier’s answer about recruitment fees is a statement about themselves. Collecting it in a comparable format across every supplier is valuable, and it is not an audit.

Carry the duty. Sections 19 and 46 put the obligation on a person, and in labour hire both the host and the agency hold it and neither can transfer it.¹² A grade produced by a model is not a defence.

Be trusted without a named human check. Parasuraman and Manzey, reviewing the evidence in Human Factors in June 2010, concluded that automation bias “occurs in both naive and expert participants, cannot be prevented by training or instructions, and can affect decision making in individuals as well as in teams”.¹² Safe Work Australia now expects you to treat this as a hazard: a person conducting a business or undertaking must manage health and safety risks from AI and digital technologies as much as they reasonably can, just as with any other hazard, and must consult workers before introducing digital technology that may affect health and safety.¹³

What This Changes for a Procurement Team.

You do not get a supply chain you can stop checking. You get a shorter list of things to check, on a supplier base you were previously sampling and calling a process.

Pick one thing to do this quarter. Take your supplier list, split it at AU$100 million in consolidated revenue, and stop asking the smaller half for a modern slavery statement they do not owe. Then look at what your reviewers spend their week on, and count how much of it is establishing whether a submission is complete rather than whether a supplier is any good. That second number is the one AI moves. The judgement underneath it was never the bottleneck.

For the safety half of this argument, AI for workplace safety covers what AI is reliable for and what it should never be handed.